docx-creator

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documentation and scripts guide the user through executing shell commands for building the project (dotnet run), performing headless document conversion (soffice), and generating images for verification (pdftoppm). These commands are standard for the tool's stated purpose of document generation and verification.
  • [EXTERNAL_DOWNLOADS]: The skill references external dependencies through well-known services. It utilizes NuGet for C# libraries (DocumentFormat.OpenXml, Markdig) and suggests using Homebrew (brew) to install poppler. These are established and well-known package management services.
  • [INDIRECT_PROMPT_INJECTION]: The tool ingests markdown content which is then parsed to create document structures.
  • Ingestion points: The C# program reads the content of a markdown file provided as a command-line argument (scripts/Program.cs).
  • Boundary markers: The skill does not implement specific boundary markers or 'ignore' instructions for the markdown content, as it is treated as data for document formatting.
  • Capability inventory: The skill has the capability to write to the local file system to create .docx files.
  • Sanitization: Content is processed through the Markdig library, which parses the markdown into an abstract syntax tree (AST) before generating OpenXML elements.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 04:51 PM
Security Audit — agent-trust-hub — docx-creator